neconyd | 4b76ea7b49bcedcb92631110c959dcb0ce29bf1ff764d385c952a99d53bea3e1

Analysis

max time kernel
144s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28/05/2024, 08:54

Target
3c20c3cda4ffaf9a90db8a10d6e81110_NeikiAnalytics.exe
Size 68KB
Sample240528-kty3vsdb7t
SHA256 4b76ea7b49bcedcb92631110c959dcb0ce29bf1ff764d385c952a99d53bea3e1
MD5 3c20c3cda4ffaf9a90db8a10d6e81110
SHA1 050b9ecc52234e6b5e2f5fdb4ed38696e29d864d
SHA512 32cdb2e855628be6a09a8b748600f791b7420f6faef81a3c87dd3ec957ff2ba507f413d4884d4eb84938953947bca5026df2e693ba6e34bcc736253f2f4d2ce2
SSDEEP 1536:Nd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:ldseIOMEZEyFjEOFqTiQm5l/5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

neconyd trojan

Family

Executes dropped EXE 2 IoCs

pid	Process
4504	omsecor.exe
1460	omsecor.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\omsecor.exe	omsecor.exe
File opened for modification	C:\Windows\SysWOW64\merocz.xc6	omsecor.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4436 wrote to memory of 4504	4436	3c20c3cda4ffaf9a90db8a10d6e81110_NeikiAnalytics.exe	91
PID 4436 wrote to memory of 4504	4436	3c20c3cda4ffaf9a90db8a10d6e81110_NeikiAnalytics.exe	91
PID 4436 wrote to memory of 4504	4436	3c20c3cda4ffaf9a90db8a10d6e81110_NeikiAnalytics.exe	91
PID 4504 wrote to memory of 1460	4504	omsecor.exe	101
PID 4504 wrote to memory of 1460	4504	omsecor.exe	101
PID 4504 wrote to memory of 1460	4504	omsecor.exe	101

C:\Users\Admin\AppData\Local\Temp\3c20c3cda4ffaf9a90db8a10d6e81110_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\3c20c3cda4ffaf9a90db8a10d6e81110_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4436
- C:\Users\Admin\AppData\Roaming\omsecor.exe
  C:\Users\Admin\AppData\Roaming\omsecor.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:4504
- - C:\Windows\SysWOW64\omsecor.exe
    C:\Windows\System32\omsecor.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    PID:1460

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3264 --field-trial-handle=2292,i,2103142837140538807,15881446839139365070,262144 --variations-seed-version /prefetch:8
1⤵
PID:452

omsecor.exe

Path C:\Users\Admin\AppData\Roaming\omsecor.exe
Size 68KB
SHA256 8363e93838ff134ff2512b01924a6f74490ce1c43179eabedf02a810da6b0ecf
MD5 4390ea30b0426f9395a9122efebfe59b
SHA1 f796aaba55cd384fa7ee1722ddea7b9a166648f6
SHA512 7f4dbd2f56841e67d3b592cae84ef576300aa728980910c506d71bea5662305c1aae442c0ee10af1538647e60abb19263bf1f3309b8fbd99e468eaea672cfb43
SSDEEP 1536:Ad9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:gdseIOMEZEyFjEOFqTiQm5l/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

omsecor.exe

Path C:\Windows\SysWOW64\omsecor.exe
Size 68KB
SHA256 659e68eef1fb53be02506d63f01efcdb14a0558dd925c6f4c65a33e40f3e225f
MD5 ffda62358b9a4d5b9c86b35bc65b378c
SHA1 d7e8d714246a15d82c826888eb5e90daab0bb907
SHA512 44cd26e257760fe11dbf7385e42bffed4eb631238964ff69d8638bbfc5ce0c0d1fa299ac809266a6940aebbb8d3e84d8fde50a4be46df97a05012cfb66f16446
SSDEEP 1536:Bd9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:xdseIOMEZEyFjEOFqTiQm5l/5
MD5 SHA1 SHA512 SSDEEP

Submit Download